CVE-2024-1597: SQL Injection in pgjdbc
Summary
CVE-2024-1597: Duplicate Advisory: SQL injection in pgjdbc. Affects org.postgresql:postgresql across 6 version ranges.
< 42.2.8
>= 42.3.0, < 42.3.9
>= 42.4.0, < 42.4.4
>= 42.5.0, < 42.5.5
>= 42.6.0, < 42.6.1
>= 42.7.0, < 42.7.2
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- postgresql-jdbc-driver · Bitnami
- libpgjava · Debian:11
The same CVE-2024-1597 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The PostgreSQL JDBC Driver, pgjdbc, is a Java library that allows applications to connect to a PostgreSQL database. It provides a set of classes and methods for executing SQL queries, managing connections, and handling database transactions. pgjdbc is widely used in Java applications that interact with PostgreSQL databases.
Vulnerability Detail
The vulnerability in pgjdbc allows an attacker to inject SQL if using PreferQueryMode=SIMPLE. This vulnerability affects versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8. In the default mode, there is no vulnerability. However, if a placeholder for a numeric value is immediately preceded by a minus and there is a second placeholder for a string value after the first placeholder on the same line, an attacker can construct a matching string payload to inject SQL and alter the query. This bypasses the protections provided by parameterized queries against SQL Injection attacks.
How To Fix
Latest published version: 42.7.14 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 42.2.842.2.8 -
>= 42.3.0, < 42.3.942.3.9 -
>= 42.4.0, < 42.4.442.4.4 -
>= 42.5.0, < 42.5.542.5.5 -
>= 42.6.0, < 42.6.142.6.1 -
>= 42.7.0, < 42.7.242.7.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a possible workaround is to avoid using PreferQueryMode=SIMPLE. Stick to the default mode or use a different mode that does not have this vulnerability.
Conclusion
The SQL injection vulnerability in pgjdbc can be mitigated by upgrading to the fixed versions or using a different query mode. It is important to promptly update the dependency in your Maven project to ensure the security of your application. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.postgresql:postgresql →
FAQ
pgjdbc is the PostgreSQL JDBC Driver, a Java library for connecting to PostgreSQL databases.
Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.
The default mode in pgjdbc does not have this vulnerability.
By constructing a specific string payload, an attacker can inject SQL and alter the query, bypassing the protections of parameterized queries.
If upgrading to a fixed version is not possible, using a different query mode or sticking to the default mode can mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.postgresql:postgresql.
